CVE-2026-66679: Improper Validation of Specified Quantity in Input

Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...

CVE-2026-32549: Missing Authorization

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

CVE-2026-28567: Missing Authorization

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-73994: Missing Authorization

Unauthenticated Broken Access Control in Charitable = 1.8.11.3 versions...

PT-2026-80449

Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs in github.com/kubev2v/migration-planner...

PT-2026-77936

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Payroll versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component of Oracle Payroll allows a low privileged attacker with network access via HTTP to compromise the system. This issue...

PT-2026-77123

Subscriber Broken Authentication in User Registration = 5.2.6 versions...

PT-2026-77189

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...

PT-2026-77126

Contributor Broken Access Control in RomethemeForm For Elementor = 1.2.6 versions...

PT-2026-77048

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

PT-2026-77186

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.p...

PT-2026-77038

Unauthenticated Broken Access Control in FormyChat = 2.15.7 versions...

PT-2026-77053

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

PT-2026-77127

Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...

CVE-2026-73396: Authentication Bypass Using an Alternate Path or Channel

Subscriber Broken Authentication in MWB HubSpot for WooCommerce = 1.6.7 versions...

CVE-2026-73381: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...

PT-2026-77090

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

PT-2026-77076

Name of the Vulnerable Software and Affected Versions Appointment Hour Booking versions prior to 1.5.92 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. Recommendations Update to a version newer than 1.5.91...

PT-2026-77074

Name of the Vulnerable Software and Affected Versions MultiVendorX versions prior to 5.0.16 Description Broken access control exists due to a missing capability check in a function, allowing unauthenticated attackers to perform unauthorized actions. Recommendations Update to version 5.0.16 or lat...

CVE-2026-66651: Missing Authorization

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through 5.0.19...